Ejabberd 17.11 版 - 收到“失败的 c2s PLAIN 身份验证”错误消息

Question

我已经在我们的服务器上安装了 Ejabberd 版本 17.11。安装完成后，用户可以第一次成功连接Ejabberd服务。但是一旦会话被该用户结束并且如果同一用户再次尝试连接，那么我们会收到以下错误消息。

websocket|) 来自 xx.xx.xxx.xxx 的 user@domain 的 c2s PLAIN 身份验证失败：用户名或密码无效

注意： 在用户关闭会话时，我们收到以下消息。这是同一用户第一次后无法连接的原因吗？

(websocket|) 为 user@domain/reg_agent 关闭 c2s 会话：连接失败：连接关闭 [info] 删除 user@domain 的所有推送会话

Answer 1

[info] 删除 user@domain 的所有推送会话

查看源代码文件 mod_push.erl，在删除帐户时会记录该消息。

因此，由于某种原因，该帐户正在被删除。如果您使用匿名身份验证，则在注销时会删除帐户。如果您使用内部或 SQL 身份验证，则应检查已启用的其他模块，这些模块可能会在注销时删除帐户。

Answer 2

这是我的 ejabberd.yml 文件配置

###
###'           ejabberd configuration file
###
###


##
loglevel: 4

##
##
log_rotate_size: 10485760
log_rotate_date: ""
log_rotate_count: 1

##
log_rate_limit: 100

##

hosts:
  - "localhost"
  - "xxxx.xxxx.com"
  - "yyyy.yyyy.com"

##

###.  =================
###'  TLS configuration

define_macro:
  'TLS_CIPHERS': "HIGH:!aNULL:!eNULL:!3DES:@STRENGTH"
  'TLS_OPTIONS':
    - "no_sslv3"
    - "cipher_server_preference"
    - "no_compression"
##   'DH_FILE': "/path/to/dhparams.pem" # generated with: openssl dhparam -out dhparams.pem 2048
##

###.  ===============
###'  LISTENING PORTS

##
## listen: The ports ejabberd will listen on, which service each is handled
## by and what options to start it with.
##
listen:
  -
    port: 5222
    module: ejabberd_c2s
    certfile: "/etc/ejabberd/ejabberd.pem"
    starttls: true
    ##
    ## To enforce TLS encryption for client connections,
    ## use this instead of the "starttls" option:
    ##
    starttls_required: true
    ##
    ## Stream compression
    ##
    ## zlib: true
    ##
    max_stanza_size: 65536
    shaper: c2s_shaper
    access: c2s
  -
    port: 5269
    module: ejabberd_s2s_in
    max_stanza_size: 131072
    shaper: s2s_shaper

  -
    port: 5280
    module: ejabberd_http
    request_handlers:
      "/websocket": ejabberd_http_ws
      "/bosh": mod_bosh
    ##  "/pub/archive": mod_http_fileserver
    web_admin: true
    http_bind: true
    ## register: true
    captcha: true

  -
    port: 5281
    module: ejabberd_http
    tls: true
    certfile: "/etc/ejabberd/ejabberd.pem"
    ##starttls: true
    request_handlers:
      "/websocket": ejabberd_http_ws
      "/bosh": mod_bosh
    ##  "/pub/archive": mod_http_fileserver
    web_admin: true
    http_bind: true
    ## register: true
    captcha: false

  ##

###.  ==============
###'  AUTHENTICATION

##
## auth_method: Method used to authenticate the users.
## The default method is the internal.
## If you want to use a different method,
## comment this line and enable the correct ones.
##
auth_method: internal

##

host_config:
    "xxxx.xxxx.com":
        auth_method: anonymous
        allow_multiple_connections: true
        anonymous_protocol: both

host_config:
    "yyyy.yyyy.com":
        auth_method: anonymous
        allow_multiple_connections: true
        anonymous_protocol: both

###.  ==============
###'  DATABASE SETUP


###.  ===============
###'  TRAFFIC SHAPERS

shaper:
  ##
  ## The "normal" shaper limits traffic speed to 1000 B/s
  ##
  normal: 1000

  ##
  ## The "fast" shaper limits traffic speed to 50000 B/s
  ##
  fast: 50000

##
## This option specifies the maximum number of elements in the queue
## of the FSM. Refer to the documentation for details.
##
max_fsm_queue: 10000

###.   ====================
###'   ACCESS CONTROL LISTS
acl:
  ##
  ## The 'admin' ACL grants administrative privileges to XMPP accounts.
  ## You can put here as many accounts as you want.
  ##
  admin:
    user:
      - "xx@xxxx.xxxx.com"
      - "xx@localhost"

  ##

  ## Local users: don't modify this.
  ##
  local:
    user_regexp: ""

  ##

  ##
  ## Loopback network
  ##
  loopback:
    ip:
      - "127.0.0.0/8"

  ##

##

###.  ============
###'  SHAPER RULES

shaper_rules:
  ## Maximum number of simultaneous sessions allowed for a single user:
  max_user_sessions: 10
  ## Maximum number of offline messages that users can have:
  max_user_offline_messages:
    - 5000: admin
    - 100
  ## For C2S connections, all users except admins use the "normal" shaper
  c2s_shaper:
    - none: admin
    - normal
  ## All S2S connections use the "fast" shaper
  s2s_shaper: fast

###.  ============
###'  ACCESS RULES
access_rules:
  ## This rule allows access only for local users:
  local:
    - allow: local
  ## Only non-blocked users can use c2s connections:
  c2s:
    - deny: blocked
    - allow
  ## Only admins can send announcement messages:
  announce:
    - allow: admin
  ## Only admins can use the configuration interface:
  configure:
    - allow: admin
  ## Only accounts of the local ejabberd server can create rooms:
  muc_create:
    - allow: local
  ## All users are allowed to use MUC service:
  muc:
    - allow
  ## Admins of this server are also admins of MUC service:
  muc_admin:
    - allow: admin
  muc_log:
    - allow: local
  ## Only accounts on the local ejabberd server can create Pubsub nodes:
  pubsub_createnode:
    - allow: local
  ## In-band registration allows registration of any possible username.
  ## To disable in-band registration, replace 'allow' with 'deny'.
  register:
    - allow
  ## Only allow to register from localhost
  trusted_network:
    - allow: all
  ## Do not establish S2S connections with bad servers
  ## If you enable this you also have to uncomment "s2s_access: s2s"


###.  ================
###'  DEFAULT LANGUAGE

##
## language: Default language used for server messages.
##
language: "en"

#
###.  =======
###'  MODULES

##
## Modules enabled in all ejabberd virtual hosts.
##
modules:
  mod_adhoc: {}
  mod_admin_extra: {}
  mod_announce: # recommends mod_adhoc
    access: announce
  mod_blocking: {} # requires mod_privacy
  mod_caps: {}
  mod_carboncopy: {}
  mod_client_state: {}
  mod_configure: {} # requires mod_adhoc
  ## mod_delegation: {} # for xep0356
  mod_disco: {}
  ## mod_echo: {}
  ## mod_irc: {}
  mod_bosh: {}

  mod_last: {}
  ## XEP-0313: Message Archive Management
  ## You might want to setup a SQL backend for MAM because the mnesia database is
  ## limited to 2GB which might be exceeded on large servers
  mod_mam: {} # for xep0313, mnesia is limited to 2GB, better use an SQL backend
  mod_muc:
    ## host: "conference.@HOST@"
    access: muc_create
    access_admin:
      - allow: muc_admin
    access_create: muc_create
    access_persistent: muc_create
    default_room_options:
        logging: true
        persistent: true
    history_size: 0
  mod_muc_admin: {}
  ## mod_muc_log: {}
  mod_muc_log:
     access_log: muc_create
     dirtype: plain
     outdir: "/data/ejabberd/muclogs"
     top_link:
         "http://xxxx.xxxx.com/" : "xxxx.xxxx.com"
  ## mod_multicast: {}
  mod_offline:
    access_max_user_messages: max_user_offline_messages
  mod_ping: {}
  ## mod_pres_counter:
  ##   count: 5
  ##   interval: 60
  mod_privacy: {}
  mod_private: {}
  ## mod_proxy65: {}
  mod_pubsub:
    access_createnode: pubsub_createnode
    ## reduces resource comsumption, but XEP incompliant
    ignore_pep_from_offline: true
    ## XEP compliant, but increases resource comsumption
    ## ignore_pep_from_offline: false
    last_item_cache: false
    plugins:
      - "flat"
      - "hometree"
      - "pep" # pep requires mod_caps
  ## mod_push: {}
  ## mod_push_keepalive: {}
  ## mod_register:
    ##
    ## Protect In-Band account registrations with CAPTCHA.
    ##
    ##   captcha_protected: true
    ##
    ## Set the minimum informational entropy for passwords.
    ##
    ##   password_strength: 32
    ##
    ## After successful registration, the user receives
    ## a message with this subject and body.
    ##
    ## welcome_message:
    ##  subject: "Welcome!"
    ##  body: |-
    ##    Hi.
    ##    Welcome to this XMPP server.
    ##
    ## When a user registers, send a notification to
    ## these XMPP accounts.
    ##
    ##   registration_watchers:
    ##     - "admin1@example.org"
    ##
    ## Only clients in the server machine can register accounts
    ##
    ## ip_access: trusted_network
    ##
    ## Local c2s or remote s2s users cannot register accounts
    ##
    ##   access_from: deny
    ## access: register
  mod_roster: {}
  mod_shared_roster: {}
  ## mod_stats: {}
  ## mod_time: {}
  mod_vcard:
    search: false
  mod_vcard_xupdate: {}
  ## Convert all avatars posted by Android clients from WebP to JPEG
  ## mod_avatar:  # this module needs compile option
  ##   convert:
  ##     webp: jpeg
  mod_version: {}
  mod_stream_mgmt: {}
  mod_s2s_dialback: {}
  mod_http_api: {}

##
##
## Enable modules management via ejabberdctl for installation and
## uninstallation of public/private contributed modules
## (enabled by default)
##

allow_contrib_modules: true

Answer 3

在 .yml 配置文件中添加以下行后，它现在可以正常工作了。

auth_use_cache: false

另外，还有一件事 - 我们可以使用 bosh 方法代替较低版本中使用的 http_bind 方法吗？对于不支持 WebSocket 功能的低版本浏览器和 iPad 应用，我们使用了这个 http_bind 方法。